GHSA-qjvr-68c3-5qhg: NetX Duo Web HTTP server interprets request body content as HTTP header fields
GHSA ID |
|
|---|---|
CVE ID |
CVE‑2026‑93003 |
Severity |
Medium |
CVSS score |
6.5 ( |
CWE |
|
Published |
2026‑10‑02 |
Last updated |
2026‑10‑02 |
Description
Summary
The Web add-on’s HTTP server searches the entire request packet for header fields instead of stopping at the end of the header section. A header field name placed in the request body is therefore reported to the server as though it were a header, which lets a client control request framing decisions it should not be able to reach.
Details
_nx_web_http_server_field_value_get() (addons/web/nx_web_http_server.c) scanned from nx_packet_prepend_ptr to nx_packet_append_ptr, covering the message body as well as the header. RFC 7230 requires header parsing to stop at the first CRLFCRLF; everything after it is opaque payload and must never be parsed as header fields.
The consequence depends on which field a caller asks for. Four call sites are affected:
-
_nx_web_http_server_chunked_check()queriesTransfer-Encoding. A request that declaresContent-Lengthbut whose body containsTransfer-Encoding: chunkedis processed as a chunked request. This is a request-framing confusion: the server frames the message differently from the way the sender declared it, and because the body is fully attacker-controlled it can be crafted to be simultaneously valid chunked data, leaving trailing bytes in the connection buffer to be read as the beginning of a following request on a keep-alive connection. -
The keep-alive decision reads
Connectionand can likewise be driven from the body. -
Multipart entity processing reads
Content-Typefrom the body. -
Conditional-GET handling reads
If-Modified-Sincefrom the body.
Impact
The primary impact is inconsistent interpretation of request framing. Where the server sits behind a front-end proxy that frames by Content-Length, the disagreement is a classic CL.TE request smuggling primitive, and the severity is governed by what the front end permits. Where the server is directly exposed, the effect is confined to the attacker’s own connection and amounts to request desynchronisation and rejected or misparsed requests.
There is no memory corruption and no information disclosure. Severity therefore depends materially on deployment topology, and the CVSS vector below reflects the directly-exposed case rather than the proxied one; deployments that terminate HTTP at a proxy in front of NetX Duo should assess it higher.
Affected configurations
The unbounded scan has been present since the initial public commit of the Web add-on (0c4f784, 2020-05-11) and is present in every release to date, up to and including v6.5.1.202602_rel.
The legacy HTTP add-on (addons/http/) has a separate header parser and is not affected by this issue.
Patches
Fixed in NetX Duo 6.5.2.202603. The scan is bounded to the header section, and the outcome of the search is tracked in an explicit flag rather than inferred from the scan pointer having run past the end of the packet. The flag is the essential part: bounding the scan without it leaves the field-absent outcome undetectable, which turns the defect into a broader one where a field missing from the request entirely is answered with bytes taken from the body.
A regression test covering the header/body boundary accompanies the fix.
A second, unrelated and much lower severity defect in the same function was fixed alongside it: the header-value whitespace skip read one byte at nx_packet_append_ptr before testing the bound. The returned status was already correct in that case, so the over-read had no observable effect; it is noted here only so that readers of the patch know what it contains, and it is not the subject of this advisory.
Workarounds
Applications that do not serve requests carrying a body are not exposed. Restricting request methods to those without a body, or rejecting requests whose body is not required by the application, limits reachability. Deployments behind a reverse proxy should ensure the proxy normalises request framing and rejects requests that carry both Content-Length and Transfer-Encoding.